d46c90d021d5330660f00a4f078a27ba0db3da7f15e0748a9b15115d8eea6dbf

Analysis

max time kernel
1558s
max time network
1784s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/11/2024, 12:25

Target
xmrig-6.22.1/pool_mine_example - Copy (12).cmd
Size 1KB
Sample241102-pl3tasvanl
SHA256 864117ff26ba29a6d9f8653448942ac23cdae066bbe5607d481ee979cb8e737c
MD5 490f14d7b7f8fe144083888c4469e4e2
SHA1 efed53892ba4b0f2bea49415f763c4ff8882c452
SHA512 f8695e502c7177992377a8896dfbd46f32505414f65709061d10c74cd2926a046e0e0a1c04e2fb9787084f75ed586c30440b8a9ef264cd35315744bbaf540eca
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1728	xmrig.exe
Token: SeLockMemoryPrivilege	1728	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	xmrig.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1728	2500	cmd.exe	31
PID 2500 wrote to memory of 1728	2500	cmd.exe	31
PID 2500 wrote to memory of 1728	2500	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.1\pool_mine_example - Copy (12).cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\xmrig-6.22.1\xmrig.exe
  xmrig --url pool.hashvault.pro:80 --user 45cCTBMicdxWx6mnVXiUkH8fZ4sKj3N98Tf7uZdbQehDZQaKMRw1DNhFFrYDnwNdtzZvTtecnnBfzWgMEB6EziQ4FB2yWN5 --pass x --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1728

memory/1728-0-0x00000000001F0000-0x0000000000210000-memory.dmp

Download

memory/1728-2-0x0000000000580000-0x00000000005A0000-memory.dmp

Download

memory/1728-1-0x0000000000560000-0x0000000000580000-memory.dmp

Download

memory/1728-3-0x0000000000560000-0x0000000000580000-memory.dmp

Download

memory/1728-4-0x0000000000580000-0x00000000005A0000-memory.dmp

Download